torzon-source[.]site

Analysis of torzon-source.site indicates the domain is currently offline but retains several indicators of malicious use. The domain resolves to IP address 81.91.178.50, which is registered to Peetinvest B.V. in the Netherlands. The hosting IP is associated with a low Gridinsoft trust score of 0 / 100 and has been listed on at least one security blocklist. The site’s TLS certificate is issued by Let’s Encrypt (R13), a common choice for short-lived certificates used by illicit operators.

VirusTotal reports that one of ninety-four scanned security vendors flagged the domain, confirming that at least one detection engine identified suspicious activity. The domain is actively blocked by the PhishDestroy service and appears on a separate blocklist, reinforcing the perception of abuse. Registration data shows the domain was created on 23 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known to host disposable or rapidly-created domains. Although the exact phishing content has not been captured, the combination of a fresh registration, low trust score, blocklist presence, and a single vendor detection aligns with the classification of a generic phishing infrastructure.

Uncertainty remains regarding the specific campaigns or credential-stealing pages that may have been hosted before takedown, as no page title or content analysis is available. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP, and consider adding the IP to reputation-based deny lists. Ongoing observation of the IP owner and any re-registration attempts is advised, as threat actors often recycle infrastructure after takedown.